bpf_ktime_get_ns 表示获取的时间为负值

Question

我使用perf对ebpf函数进行采样，但是我使用bpf_ktime_get_ns获取系统当前秒数发现为负值，不知道为什么

SEC("perf_event")
int do_perf_event(struct bpf_perf_event_data *ctx) {
    u32 tgid = 0;
    u32 pid = 0;
    u64 id = bpf_get_current_pid_tgid();
    pid = id;
    if ( pid == 0 )
        return 0;
    tgid = id >> 32;
    //create map key
    struct key_t key = {0};
    key.pid =tgid;
    u64 ts = bpf_ktime_get_ns();
    key.ntime= ts;
    bpf_perf_event_output((struct pt_regs *)ctx, &output_events, BPF_F_CURRENT_CPU, &key, sizeof(key));
    return 0;
}

reader, err := perf.NewReader(objs.bpfMaps.OutputEvents, 10000 * int(unsafe.Sizeof(bpfSchedEventT{})))
for {
    record, err := reader.Read()
    var event bpfSchedEventT
    if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil {
         continue
     }

     fmt.Println(event.Pid,event.Ntime)
}

 pid          bpf_ktime_get_ns 2304287 -4952501534609899520 2304287 -4951917187129409536 2304287 -4909853600282312704 2304287 -4909930153779396608 2304287 -4909776359590461440 2304287 -4909124929015775232 2305278 -4908938351341469696 2134146 -4909027119725543424 4026847 -4908622722784821248

不知道为什么时间是负数

Answer 1

当我把u64放在上面时

struct key_t { u64 ntime; u32 pid; };